PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Continuously fuzzing Python C extensions

blog.trailofbits.com | blog | #open-source | #fuzzing | #python | #memory-corruption | #oss-fuzz | #atheris | #cbor2
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Trail of Bits demonstrates fuzzing Python C extensions with Google's Atheris, integrating the cbor2 library into OSS-Fuzz with CIFuzz for continuous fuzzing and uncovering memory corruption bugs.
Published
Collected

Related coverage

research · projectzero.google
Blasting Past Webp
A deep dive into WebP image parsing and libwebp exploitation, tracing how memory corruption in the codec can be weaponized and why it became such a widely targeted surface.
blog · blog.trailofbits.com
SequenceHash: multihashing for the rest of us
We're releasing SequenceHash and its sister function SequenceMAC, a pair of related hash constructions that bring secure multihashing to developers using hash functions other than Keccak.
blog · blog.trailofbits.com
1Password's AI patching benchmark is misleading
Trail of Bits says 1Password's FLAWED benchmark misstates AI patch quality, mixing wrong-fix prompts and no-test trials into a 26% clean-fix headline, and ships two agent skills for better fixes.
blog · blog.trailofbits.com
Uncovering memory corruption in NVIDIA Triton (as a new hire)
In my first month at Trail of Bits as an AI/ML security engineer, I found two remotely accessible memory corruption bugs in NVIDIA's Triton Inference Server during a routine onboarding practice.
blog · blog.trailofbits.com
How we applied advanced fuzzing techniques to cURL
Working with OSTIF, Trail of Bits analyzed and improved cURL's fuzzing code, adding seeds and options that doubled HSTS coverage, quintupled Alt-Svc coverage, and extended fuzzing to WebSocket.
blog · blog.trailofbits.com
cURL audit: How a joke led to significant findings
Trail of Bits' 2022 cURL audit fuzzed the CLI with AFL++, uncovering CVE-2022-42915 and CVE-2022-43552 plus use-after-free and memory-leak bugs fixed in cURL 7.86.0/7.87.0.
Back